Cornerstone Licensing Services disclosed a data security incident to the Indiana Attorney General on February 3, 2026, triggering legally mandated notification letters. If you are one of the people who received Cornerstone Licensing Services's letter, your data may have been exposed and you could be entitled to compensation.
The Indiana Attorney General filing confirms the breach notice — not a court case. Where no court record exists, no settlement figure or deadline is shown. Legal outcomes cannot be predicted or promised.
The official Indiana AG notice for Cornerstone Licensing Services identifies the following exposed data:
The more sensitive the data involved, the stronger the potential claim. Disclosure of these categories is legally recognized harm.
Cornerstone Licensing Services operates as a critical administrative and regulatory compliance partner, processing high-stakes credentialing, professional licensing, and permit applications across various regulated industries. Because of the nature of its operations, the company acts as a central repository for vast quantities of sensitive PII and confidential enterprise records. To successfully process license renewals, background verifications, and compliance audits, Cornerstone routinely collects and stores extensive personal dossiers on professionals, business owners, and corporate officers. This vast accumulation of high-value data makes the company an attractive target for malicious cyber actors seeking to exploit systemic vulnerabilities for financial gain or identity theft.
In 2026, Cornerstone Licensing Services formally reported a significant data security incident to the Indiana Attorney General, alerting state regulators and impacted individuals to an unauthorized compromise of its network infrastructure. While exact forensic findings continue to emerge, breaches affecting credentialing and regulatory processing entities typically involve sophisticated cyberattacks such as unauthorized database infiltration, ransomware deployment, or third-party vendor compromise. These incidents often exploit weak perimeter defenses, unpatched software vulnerabilities, or compromised employee credentials, allowing threat actors to dwell undetected within corporate networks and exfiltrate gigabytes of confidential files before detection occurs.
Investigations into the Cornerstone Licensing Services breach indicate that the exposed data likely encompasses a dangerous combination of Personally Identifiable Information (PII) and sensitive financial or professional records. Depending on the scope of the exposure, compromised records frequently feature full legal names, Social Security numbers, dates of birth, home addresses, professional license numbers, tax identification details, and banking information used for fee processing. The exposure of this information creates severe, immediate risks for victims. Social Security numbers and birth dates form the bedrock of identity theft, enabling criminals to open fraudulent credit accounts, secure unauthorized loans, or intercept government benefits. Meanwhile, compromised professional and tax records can facilitate corporate identity fraud, targeted phishing campaigns, and sophisticated tax refund scams.
As an entity handling sensitive consumer and professional data, Cornerstone Licensing Services was legally obligated to implement robust administrative, physical, and technical safeguards to protect this information from unauthorized access. Under the Indiana Disclosure of Security Breach Law, alongside applicable state consumer protection statutes and the Federal Trade Commission (FTC) Act, companies that collect personal data have an affirmative duty to maintain reasonable security procedures. The occurrence of a widespread data breach strongly suggests a potential failure of these legal obligations, including inadequate encryption standards, delayed patching protocols, or a failure to properly vet third-party vendor access. When a company fails to maintain these standards, it exposes its users to lifelong privacy risks and potential financial devastation.
If you received an official data breach notification letter from Cornerstone Licensing Services, it serves as legal acknowledgment that your sensitive personal information was compromised due to inadequate security measures. Legally, this notification confirms your standing to participate in a class action lawsuit aimed at holding the company accountable for failing to safeguard your data. Under established class action jurisprudence, victims do not need to prove that they have already suffered actual financial loss to seek legal relief; the increased, imminent risk of identity theft is sufficient. Our firm is actively investigating potential claims against Cornerstone Licensing Services on a contingency fee basis, meaning you pay absolutely nothing out of pocket, and we only collect a fee if we successfully recover compensation on your behalf.
Notification Delay: Approximately 10 months elapsed between the reported date of the security incident and the company's notification to the Attorney General. Courts have found that excessive notification delays independently support legal claims.
Financial harm is not a requirement. The exposure of your personal information is itself recognized as actionable. Check the list — most letter recipients qualify under at least one item:
You received a data breach notification letter from Cornerstone Licensing Services
You were a customer, patient, employee, or client of Cornerstone Licensing Services
Your personal information was stored in Cornerstone Licensing Services's systems
Your Social Security number or driver's license number was exposed
Your financial account, credit card, or banking information was disclosed
You reside in the United States (all 50 states eligible)
That letter is legally required and confirms your data was exposed. It also gives you standing to file a claim.
What your notification letter means & what to do next →Do these four things as soon as possible; each one protects you and strengthens any claim:
Do not discard the Cornerstone Licensing Services letter. It documents your standing as an affected individual — the foundation of any claim you file.
Cornerstone Licensing Services typically offers free credit monitoring to affected individuals. The enrollment code is usually in the letter — activate it even if you see no signs of fraud.
Lock down your credit file at Equifax, Experian and TransUnion with a free security freeze — thieves cannot open accounts on a frozen file.
Deadlines apply to breach claims. A free review of your Cornerstone Licensing Services letter takes minutes, and we only get paid if you do.
Security Incident
2025-03-26
An unauthorized party accessed Cornerstone Licensing Services systems that stored personal information.
Reported to Attorney General
February 3, 2026
Cornerstone Licensing Services's disclosure was logged with the Indiana Attorney General's office.
Consumer Notification Letters Sent
Within weeks of AG filing
Notification letters are sent by mail to all individuals whose data was involved.
Legal Window — Act Now
Statute of limitations applies
Legal deadlines limit how long you have to act on this breach.
Compensation in a case like Cornerstone Licensing Services's depends on where you live, what was exposed, and how the company responded. Common recovery categories:
Statutory damages exist independent of out-of-pocket loss — California's $100–$750 range is the model other states have followed.
Covers fraud charges, unauthorized account activity, and expenses traced directly to the breach.
The time you lost to credit freezes, fraud disputes, and account monitoring counts as a recoverable inconvenience.
If you paid for credit monitoring or identity protection after the breach, those costs can be recovered.
SSN and driver's license exposure creates long-term identity theft risk. Courts recognize the ongoing value of this harm and may award damages accordingly.
Exposure of financial account or credit/debit card information entitles victims to recover for actual and potential fraud losses.
Indiana's data breach law (IC 24-4.9) requires companies to notify affected residents and the Attorney General. Indiana residents may pursue damages under the Deceptive Consumer Sales Act for a company's failure to protect personal information.
Other companies have notified the Indiana AG of breaches. Received one of these letters as well? You may have more than one claim.
Zaxis Financial Services Americas LLC
Indiana · Sep 2026
Woodlawn Hospital
Indiana · Sep 2026
Wooddesign RV Interiors LLC
Indiana · Sep 2026
Woodard, Emhardt, Henry, Reeves, & Wagner LLC
Indiana · Aug 2026
Wired Communications
Indiana · Jun 2026
33156
Indiana · Mar 2026
Contact us for a FREE consultation. No fee unless we win your case.
(786) 306-7278Free Claim ReviewLaw Office of David S. Harris